TWS_IOCTL_GET_LOCK result dead-stored: time_remaining_msec/grant state computed but never copied back to the caller (advisory ioctl lock unobservable)
Summary
The GET_LOCK case computes time_remaining_msec in both branches and sets status but never copies lpkt back - userland can never observe the lock state, so the advisory serialization the lock exists to provide is silently unenforceable. A DFly port regression (FreeBSD does the copy-back). No memory-safety impact. Restore-copy-back fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4989 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| tws_getlock.c | — | 3.6 KB | view raw | |
| build.sh | — | 96 B | view raw | |
| run.sh | — | 94 B | view raw | |
| build.log | — | 63 B | view raw | |
| run.log | — | 910 B | view raw | |
| env.txt | — | 229 B | view raw | |
| fix.diff | — | 675 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
Fix verification
not_testableHardware-gated; fix.diff restores the missing copy-back, returning the computed lock state to the caller exactly as the FreeBSD original does.
Confirmed kernel references
Detail
Evidence (decisive lines)
run.log (clean build + ENOENT + pciconf: no LSI device); VERDICT.md (line-by-line trace of the dead store); tws_getlock.c (issues GET_LOCK twice and prints the fields that stay unchanged)
PoC changes
n/a (authored fresh); tws_ioctl_with_payload layout mirrored inline
Verified recommended fix
Add memcpy(ubuf->data_buf, &lpkt, sizeof(struct tws_lock_packet)) at the end of the TWS_IOCTL_GET_LOCK case in tws_ioctl_aen
Verdict
Hardware-gated (no 3ware controller on the audit guest; PoC builds clean and exits ENOENT, run.log). The defect is a dead store: tws_user.c:282-294 computes lpkt.time_remaining_msec in both GET_LOCK branches (granted at :288, remaining-time at :290-291) but never copies lpkt back to ubuf->data_buf, and the function returns SUCCESS (:335) — so the advisory ioctl lock's grant/deny state and remaining time can never reach userland and management agents cannot enforce the serialization the lock exists for. FreeBSD's tws_user.c performs the copy-back; this is a port regression. No memory-safety impact; Low.
No comments yet.